api.branchly.io

The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.

The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.

The 'mcp_server' tool_type accepts an arbitrary mcp_url plus custom headers (which could include auth tokens) and lets the configured chatbot call out to that server at runtime. An attacker with access to this admin API could point production chat/search agents at a malicious MCP server, which could then return content designed to inject instructions into the agent's context during live conversations. This is a supply-chain style risk beyond simple CRUD and should be restricted/audited (e.g., URL allow-listing, review before activation).

update_tool allows changing mcp_url, headers, or api_tool_arguments (method/url/headers/body) of existing tools. This permits silently redirecting a previously-trusted tool to a different external endpoint or injecting new headers/credentials, which could be used to exfiltrate data processed by the tool or to swap in an attacker-controlled backend without changing the tool's name/description that the agent already trusts.

The api_tool_arguments schema lets an operator define arbitrary URL, headers, and body content (with mustache templating of user-collected parameters) for GET/POST/PUT/PATCH/DELETE calls to any endpoint. Combined with the ability to embed static header/body values (e.g. API keys) this creates a broad capability for data exfiltration to external URLs or SSRF against internal services if misused, exceeding what a narrowly-scoped 'API tool' should require.